Search: “Defender for Servers”

5 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 49 Threat actor 45 Exploit / PoC 43 Industry 31 Vulnerability 20 Advisory 17 AI safety & security 15 Research 8 Policy & legal 8 Tools 7 Ransomware 6 Data breach 4 Phishing & fraud 3 AI industry 1

SeverityAll critical 24 high 103 medium 62 low 4 info 65

New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systemsnew

Huntress reports new Settra ransomware hit retail and manufacturing firms, using MeshAgent RMM, BYOVD, and Windows utilities to encrypt systems and block recovery.

Huntress investigated two Settra intrusions: a consumer services and retail organization in July 2026 and a manufacturing firm in September 2026, showing nearly identical post-compromise behavior. Operators installed the MeshAgent RMM, ran ransomware executables named after the victim domain (_win64.exe), encrypted files with .locked or .locked_wip extensions, and dropped RESTORE_FILES.txt ransom notes. In both cases attackers cleared Windows Event Logs, disabled the Windows Recovery Environment, and used DiskPart to remove the recovery partition; the July case also ran Cipher to overwrite free space and flushed DNS cache. The September incident added BYOVD using gdrv.sys, and initial access was suspected via VPNs or previously stolen credentials, though unconfirmed.

Cyber Security News13:44 UTC · 23m agoRansomware in the wild 3 sources

Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS

New Panzer ransomware-as-a-service operation lists Italian firms Doimo Cucine and NTE Italia as victims, offering encryptors for Windows, Linux, FreeBSD, and ESXi.

Panzer, a ransomware-as-a-service operation that surfaced August 5, listed a kitchen manufacturer in Treviso (Doimo Cucine) and a telecommunications engineering firm in Catanzaro (NTE Italia) among alleged victims, claiming 30 GB and 16 GB of stolen data respectively. The group advertises encryptors for Windows, Linux, FreeBSD, and VMware ESXi, a Tox-based affiliate recruitment process with screening, an affiliate dashboard, and an 80/20 revenue split. Neither victim had publicly confirmed the incidents when researcher Andrea Fortuna's report was published, and the group's first access method and payload have not been independently analyzed. Panzer posted victims across 11 countries as claimed Italian ransomware incidents reached 212 by September 6, already above 2025's full-year total of 169.

Cyber Security NewsSep 8, 09:10 UTC · 10d agoRansomware in the wild

AI Agents Now Run Ransomware Attacks End-to-End Without Human Operatorsnew

SOCRadar documented JADEPUFFER, an AI agent that autonomously executed a ransomware campaign from Langflow exploit through encryption and extortion.

SOCRadar researchers tracked JADEPUFFER, a campaign in which an AI agent planned and executed ransomware without evidence of human approval, entering through CVE-2025-3248, a missing-authentication flaw in Langflow's code-validation endpoint allowing unauthenticated Python execution. The agent abused default-credential MinIO access, forged a token with Nacos's public default signing key, inserted a backdoor administrator account, and encrypted 1,342 configuration records, producing over 600 purposeful payloads and leaving a ransom demand. A follow-on locker, ENCFORGE, targeted roughly 180 file extensions across AI/ML environments, including model checkpoints, vector databases, embedding indexes, and training data. An IoC table attributes the activity to the Lynx/INC Ransomware Group, lists C2 at 45.131.66.106, and links CVE-2026-24858 to the related FortiBleed 14-agent framework campaign.

Cyber Security News13:24 UTC · 44m agoRansomware in the wild 2 sources CVE-2025-3248 CVE-2026-24858

Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets

Aurora ransomware operators used Cursor AI running Claude Sonnet to plan and execute intrusions against dozens of organizations in nine countries.

CloudSEK and Gambit Security analyzed exposed infrastructure tied to the Russian-speaking Aurora (Aur0ra) group, revealing months of activity against more than 20 organizations across nine countries between April and July 2026, with 33 victims listed by Ransomware.Live. The operator used the Cursor agentic coding assistant to plan attacks in Russian, including an AD CS exploitation plan, and Gambit observed Cursor Agent (running Anthropic's Claude Sonnet) performing hands-on exploitation tasks such as Nmap scanning, NetExec enumeration, NTLM relay, and certificate attacks against 10 targets. Attacks begin with email bombing plus IT help desk vishing via Xray-core, followed by SMB/LDAP/WinRM/RDP lateral movement, log clearing, Defender disabling, and exfiltration; the Windows and Linux/ESXi encryptors are built from a single Zig codebase, with shadow copy deletion and VM-killing before encryption.

The Hacker NewsAug 31, 11:47 UTC · 18d agoRansomware in the wild1

Feral Wolf Hackers Exploit Confluence and 1C to Deploy GenieLocker Ransomware

Feral Wolf exploited Atlassian Confluence and 1C:Enterprise flaws to deploy GenieLocker ransomware across Russian retail, construction, manufacturing and IT firms.

BI.ZONE DFIR tracked Feral Wolf intrusions at Russian retail, construction, manufacturing, and IT organizations from May through August 2026. The actor exploited CVE-2023-22515 on internet-facing Confluence instances, deployed GSocket and Rust-based MQTTDoor/MatrixDoor backdoors using MQTT and Matrix C2, and used PwnKit (CVE-2021-4034) and Copy Fail (CVE-2026-31431) for privilege escalation and container-to-host escape. The group abused exposed 1C:Enterprise cluster managers and weak PostgreSQL credentials to move laterally before deploying GenieLocker ransomware.

GBHackers13:02 UTC · 1h agoRansomware in the wild 2 sources CVE-2023-22515 CVE-2021-4034 CVE-2026-31431